Security Incidents mailing list archives
Increase in MS vuln WebDav scans
From: "Hubbard, Dan" <dhubbard () websense com>
Date: Tue, 1 Jun 2004 08:03:19 -0700
Has anyone else seen an increase in WebDav scans over the last couple weeks ? Mosty from University of Pen. ? We had not seen this for months until recently. Is there a worm that uses this vuln. ? Truncated cut samples: 69.55.196.196 - - [29/May/2004:00:44:29 -0400] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 2 69.192.170.241 - - [28/May/2004:08:23:30 -0400] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 2 69.156.225.78 - - [27/May/2004:00:00:59 -0400] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 2 69.14.84.117 - - [23/May/2004:09:20:49 -0400] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 2
Current thread:
- Increase in MS vuln WebDav scans Hubbard, Dan (Jun 01)
- <Possible follow-ups>
- Re: Increase in MS vuln WebDav scans caldcv (Jun 01)
- Re: Increase in MS vuln WebDav scans Jose Nazario (Jun 02)
- Re: Increase in MS vuln WebDav scans Cory Donnelly (Jun 02)